Windows NT Policies

Policies are selected using the "Policies" button in "User Manager for Domains". Policy changes modify information in the registry subtrees HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE.

Account Policies

These policies are set using the "User Manager for Domains". Only a local administrator within the domain can set policies. NT Server adds one type of account policy to the User Manager beyond NTWS which is:

User - HKEY_CURRENT_USER registry portion is modified. Settings for one user are changed.

Group - Policies applied to groups. One group may have a higher profile priority than another, for the case when a user belongs to multiple groups. This is set using the "Options" menu with "Group Priority".

Default user - HKEY_CURRENT_USER registry portion is modified. Settings for any domain user that logs on from any computer are changed.

Policy settings are determined by precidence as listed above. For example, user settings override all other group, and default user policies. Group policies override Default user policies. A System (computer) policies override user and group policies. Specific computer policy overrides default system policy. Group policy priority (when a user is in multiple groups) is specified in the system policy editor.
Policy changes may be made to a policy file rather than the registry. The following policy files are used for the following systems:

NTCONFIG.POL - For NT

CONFIG.POL - Windows 95

The policy must be saved in the \WINNT_ROOT\NETLOGON directory of the authenticating domain controller in order to take effect. The \WINNT_ROOT\NETLOGON\ directory points to \WINNT_ROOT\SYSTEM32\REPL\IMPORT\SCRIPTS by default. These profile settings will override settings made in user manager. The following policy template files exist:

COMMON.ADM - For Windows 95 and Windows NT

WINNT.ADM - For Windows NT.

WINDOWS.ADM - For Windows 95.

Policy Storage

Policies are stored in the registry, so deleting the system policy file does not remove the policy. Any undesired policies must be removed the same as they were set. When setting policies, the options in the boxes apply:

Blank - Policy is set to its default value.

Checked - A policy is enforced.

Grey - Whatever is currently in the registry applies. No policy is enforced.